Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows: SQLCmd used to dump database metadata and backups
Alerts on Windows executions of sqlcmd.exe with local server targeting and database enumeration/backup query fragments.
frack113, Huntrule TeamWindowsprocess_creationHigh513Free2021-08-16Webserver GET requests containing XSS-related payload strings
Finds likely XSS injection attempts in webserver GET requests by matching script, tag, and JS payload strings while excluding 404s.
Saw Win Naung, Nasreddine Bencherchali, Huntrule TeamWebwebserverHigh378Free2021-08-15Zeek DNS queries matching Tor proxy and hidden service domains
Alerts on Zeek DNS queries for Tor proxy and onion domain indicators tied to possible anonymized activity.
Saw Winn Naung , Azure-Sentinel, Huntrule TeamZeekdnsMedium192Free2021-08-15Google Cloud Audit: DNS Managed Zone Modified or Deleted
Flags Google Cloud DNS Managed Zone delete, update, and patch events from audit logs.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium4510Free2021-08-15Google Cloud DLP Re-identifies Sensitive Data via projects.content.reidentify
Detects Google Cloud DLP re-identification activity using projects.content.reidentify in audit logs.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium121Free2021-08-15AWS EFS Mount Target Modified or Deleted via CloudTrail
Detects CloudTrail-reported deletion of an AWS EFS mount target that can break dependent instances or applications.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailMedium172Free2021-08-15AWS EFS Filesystem Modified or Deleted via CloudTrail
Alert on AWS EFS file system deletion activity observed in CloudTrail via DeleteFileSystem events.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailMedium346Free2021-08-15GCP Audit: Service Account Modified via IAM Patch/Create/Update/Enable/Undelete
Flags GCP audit events indicating service account create, update, enable, undelete, or patch operations.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium2010Free2021-08-14Google Cloud: Service Account Disabled or Deleted via IAM Audit Events
Identifies GCP IAM audit events where service accounts are disabled or deleted via serviceAccounts.disable/delete.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium243Free2021-08-14GCP Audit: Storage Bucket Modified or Deleted via Storage API
Alert on GCP audit events indicating storage bucket insert, update, patch, or delete actions.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium478Free2021-08-14GCP Audit Alerts for Google Cloud Storage Bucket Enumeration via Listing APIs
Triggers on GCP audit events indicating Storage bucket listing (storage.buckets.list or listChannels).
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditLow183Free2021-08-14GCP Audit: Full Network Packet Capture via Compute PacketMirrorings API
Alerts on GCP Compute PacketMirrorings API calls that may enable full network packet capture.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium182Free2021-08-13GCP Audit: Firewall Rule Insert, Update, Patch, or Delete
Flags GCP audit events where firewall rules are inserted, updated, patched, or deleted.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium464Free2021-08-13Windows whoami.exe Execution from Suspicious Parent Processes
Alerts on whoami.exe runs where the parent process is not a typical shell or monitoring agent.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium172Free2021-08-12Windows whoami.exe Renamed Execution via Mismatched OriginalFileName
Alerts when a renamed process still reports OriginalFileName as whoami.exe on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical230Free2021-08-12